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DETAILED ACTION 

Claims 1-25 and 27 -35 have been examined. 

Claims 32 - 25 have been added. 

Claim 26 have been canceled. 

Claims 1, 27, 28 and 30 have been amended. 

Claim Rejections - 35 USC § 112 

1 . The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

2. Claim 35 rejected under 35 U.S.C. 1 12, second paragraph, as being incomplete for 
omitting essential elements, such omission amounting to a gap between the elements. See MPEP 
§ 2172.01. The omitted elements are: "compared for what?". 

Claim 35 

The method as recited in claim 32, wherein results of the operations during the execution of the 
full-release scanner update and the pre-release scanner update are compared. 
Examiner's Response 

The updates can be compared to many things. The claim does not state they need to be compared 
to each other. The can be compared to a wide variety of items such as a error code, parity error 
test, checksum test or a file size test. The limitations is too indefinite to determine the scope of 
the claim limitations present. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
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such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

4. Claims 1 - 21 and 27 - 35 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Norton Antivirus Corporate Edition version 7.0. released 1999 (Called Norton). 
Claim 1 

A method for testing scanner updates executing on a computer readable medium, comprising: 

(a) distributing a full-release scanner update from a server to a plurality of computers utilizing a 
network; 

(b) distributing a pre-release scanner update from the server to the computers utilizing the 
network; 

(c) executing the full-release scanner update on the computers for security scanning; 

(d) executing the pre-release scanner update on the computers for testing purposes; and 

(e) transmitting results of the testing from the computers to the server utilizing the network; and 

(f) utilizing the results to modify the pre-release scanner update before releasing the pre- 
release scanner update as a full release scanner update. 

Examiner's Response 

Norton also discloses Symantec Antivirus Research Center (SARC). A Center where viruses are 
tracked, identified and analyzed and new anti virus technology is developed (Norton, page 8). 
Over 40,000 known virus definitions are on file. Realtime Protection constantly monitors activity 
on your computer by looking for virus signatures (Norton, page 8). LiveUpdate provides 
downloads of new antivirus protection to computers (Norton, page 8) regularly by automatically 
connecting to the special Symantec site and determining if your files need updating, downloads 
the proper files and installs them in the proper location (Norton, page 8). Cures are also send via 
email (Norton, page 9). A Managed Solution is detailed in Chapter 2. A Quarantine Server for 
virus infected files, copies of infected items are forward to the Quarantine on the client machine 
to the central Quarantine (Norton, page 1 1). Quarantine tests and confirms new updates and the 
updates are rolled out to client machines (Norton, page 12). Client machines upon receiving the 
update perform selected preset operations, such as repair the infected item and releasing it from 
the client Quarantine automatically (Norton, 12). Additional details, on topics such as, SARC is 
available on page 19, LiveUpdate page 20, Quarantine pages 29 to 33. The reference must be 
taken as a whole. 

Note: Applicant has moved the limitations of canceled claim 26 to some of the independent 
claims. The limitations do not distinguish the claimed invention. From the originally cited 
section, "Quarantine tests and confirms new updates and the updates are rolled out to client 
machines (Norton, page 12)." Applicant appears not to believe Norton tests bug fixes and based 
on the results updates before releasing pre-release scanner updates. 

In view of the maintaining of the original grounds of rejection. When taking the reference as a 
whole the Applicant should also review the interaction through email (Norton, pages 31-33). 
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Claim 2 

The method as recited in claim 1, wherein the full-release scanner update and the pre-release 
scanner update are distributed simultaneously. 
Examiner's Response 

LiveUpdate provides downloads of new antivirus protection to computers (Norton, page 8) 
regularly by automatically connecting to the special Symantec site and determining if your files 
need updating, downloads the proper files and installs them in the proper location (Norton, page 
8). 

Claim 3 

The method as recited in claim 1, wherein the full-release scanner update and the pre-release 
scanner update are distributed together. 
Examiner's Response 

Examiner see no difference between the claim limitations of claim 2 and claim 3. If the update 
has both update and a pre-release then they are simultaneously distributed together. 
See the rejection for claim 2. 

Claim 4 

The method as recited in claim 1, wherein the pre-release scanner update is distributed on a 
periodic basis. 
Examiner's Response 

As update date distributed signatures and coinciding with scheduled updates ( Norton, pages 1 1 - 
13 ) and covered in claim 1 . 

Claim 5 

The method as recited in claim 1, wherein the pre-release scanner update is distributed with virus 
signatures. 

Examiner's Response 

Norton, page 7 last paragraph, (signatures numerous reference points in Norton document). 
Claim 6 

The method as recited in claim 1, and further comprising automatically determining whether a 
pre-release scanner update exists, and conditionally distributing the pre-release scanner update 
from the server if the pre-release scanner update exists. 
Examiner's Response 

LiveUpdate provides downloads of new antivirus protection to computers (Norton, page 8) 
regularly by automatically connecting to the special Symantec site and determining if your files 
need updating, downloads the proper files and installs them in the proper location (Norton, page 
8). 



Claim 7 
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The method as recited in claim 1 , wherein the pre-release scanner update is executed when the 
computers are idle. 
Examiner's Response 

One interpretation in view of the present limitations is that the user schedules scans of viruses at 
a time the machine will not be used. (Norton, page 25, scheduling scans and page 23 run 
unattended) 

Claim 8 

The method as recited in claim 1 , wherein the pre-release scanner update is executed 
automatically when the computers are idle. 
Examiner's Response 

One interpretation in view of the present limitations is that the user schedules scans of viruses at 
a time the machine will not be used. (Norton, page 25, scheduling scans and page 23 run 
unattended) 

Claim 9 

The method as recited in claim 1 , wherein the results are transmitted to a quality assurance 

administrator. 

Examiner's Response 

Norton's Symantec Antivirus Research Center (SARC) pages 8-9. 
Claim 10 

The method as recited in claim 1 , and further comprising comparing results of the execution of 
the full-release scanner update and the pre-release scanner update. 
Examiner's Response 

As per claim 1 the development of new antivirus protection and the distribution of such updates. 
Claim 32 

The method as recited in claim 1 , further comprising recording operations of the full-release 
scanner update during the execution of the full-release scanner update. 
Examiner's Response 
Norton (page 18, Histories). 

Claim 11 

The method as recited in claim 10, wherein the comparison occurs on the computers. 
Examiner's Response 

Norton (pages 12-13 and 24 - 25 , virus scan ) 
Claim 12 

The method as recited in claim 11, and further comprising transmitting results of the comparison 
from the computers to the server utilizing the network. 
Examiner's Response 

Norton, pages 29 - 32, Quarantine, Submitting a potential infected file to SARC for analysis) 
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Claim 13 

The method as recited in claim 1, wherein the network includes the Internet. 
Examiner's Response 
Norton, page 15, Internet 

Claim 14 

The method as recited in claim 10, and further comprising determining whether a virus is 
detected by the execution of the pre-release scanner update and not the full-release scanner 
update based on the comparison. 
Examiner's Response 

Claim 1 mentioned the collection of over 40,000 known virus signatures. And a reporting 
mechanism to the Central operation and page 1 8, Virus definition file information 

Claim 15 

The method as recited in claim 14, and further comprising removing the virus. 
Examiner's Response 

Norton, page 29, To act on an infected file, bullet 2. 
Claim 16 

The method as recited in claim 14, and further comprising storing a record of the virus. 
Examiner's Response 

Norton, page 29, To act on an infected file, bullet 4. 
Claim 17 

The method as recited in claim 14, and further comprising reporting the virus. 
Examiner's Response 

Norton, page 29, To act on an infected file, Note - if set to display alert operator is notified. 
Claim 18 

The method as recited in claim 1, and further comprising detecting faults associated with the 
execution of the pre-release scanner update. 
Examiner's Response 

Norton, page 29, To act on an infected file, bullet 1 . The unsuccessful run of a new signature is 
still a detectable state. If the same conditions exist that caused the virus to be detected the virus 
can be detected if not corrected. The scan of claims above that is able to done on demand or 
schedules (Norton, pages 23 - 28). 

Claim 19 

The method as recited in claim 1 8, and further comprising transmitting a record of the faults 
from the computers to the server utilizing the network. 
Examiner's Response 

Norton, page 29, To act on an infected file, bullet 1 . The unsuccessful run of a new signature is 
still a detectable state. If the same conditions exist that caused the virus to be detected the virus 
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can be detected if not corrected. The scan of claims above that is able to done on demand or 
schedules (Norton, pages 23 - 28). 

Claim 20 

The method as recited in claim 1 8, and further comprising ceasing the execution of the pre- 
release scanner update on the computers in response to the detection of the faults. 
Examiner's Response 

Norton, page 22, Turn off protection (temporarily). Can be user who turns it off based on present 
claim limitations. 

Claim 21 

The method as recited in claim 20, and further comprising re-executing the pre-release scanner 
update on the computers after ceasing the execution. 
Examiner's Response 

Norton, page 22, Turning back on the file protection so realtime file protection can run. 
Claim 27 

A computer program product for testing scanner updates executing on a computer readable 
medium, comprising: 

(a) computer code for distributing a full-release scanner update from a server to a plurality of 
computers utilizing a network; 

(b) computer code for distributing a pre-release scanner update from the server to the computers 
utilizing the network; 

(c) computer code for executing the full-release scanner update on the computers for security 
scanning; 

(d) computer code for executing the pre-release scanner update on the computers for testing 
purposes; and 

(e) computer code for transmitting results of the testing from the computers to the server utilizing 
the network; and 

(f) computer code for utilizing the results to modify the pre-release scanner update before 
releasing the pre-release scanner update as a full release scanner update. 

Examiner's Response 

The limitations of this claim have been covered in the rejections above (see claim 1). 
Claim 28 

A system for testing scanner updates executing on a computer readable medium, comprising: 

(a) logic for distributing a full-release scanner update from a server to a plurality of computers 
utilizing a network; 

(b) logic for distributing a pre-release scanner update from the server to the computers utilizing 
the network; 

(c) logic for executing the full-release scanner update on the computers for security scanning; 

(d) logic for executing the pre-release scanner update on the computers for testing purposes; and 

(e) logic for transmitting results of the testing from the computers to the server utilizing the 
network; and 
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(f) logic for utilizing the results to modify the pre-release scanner update before releasing 
the pre-release scanner update as a full release scanner update. 

Examiner's Response 

The limitations of this claim have been covered in the rejections above (see claim 1). 
Claim 29 

A server-based method for testing scanner updates executing on a computer readable medium, 
comprising: 

(a) distributing a full-release scanner update from a server to a plurality of computers utilizing a 
network; 

(b) distributing a pre-release scanner update from the server to the computers utilizing the 
network; 

(c) receiving results of the execution of the full-release scanner update and the pre-release 
scanner update from the computers; 

(d) modifying the pre-release scanner update before releasing the pre-release scanner update as a 
full-release scanner update based on the results. 

Examiner's Response 

The limitations of this claim have been covered in the rejections above. 
Claim 30 

A client-based method for testing scanner updates executing on a computer readable medium, 
comprising: 

(a) receiving from a server a full-release scanner update at a computer utilizing a network; 

(b) receiving from the server a pre-release scanner update at the computer utilizing the network; 

(c) executing the full-release scanner update on the computer for security scanning; 

(d) executing the pre-release scanner update on the computer for testing purposes; and 

(e) transmitting results of the testing from the computer to the server utilizing the network; and 

(f) utilizing the results to modify the pre-release scanner update before releasing the pre- 
release scanner update as a full release scanner update. 

Examiner's Response 

The limitations of this claim have been covered in the rejections above (see claim 1).. 
Claim 31 

A method for testing scanner updates executing on a computer readable medium, comprising: 

(a) distributing a full-release scanner update from a server to a plurality of computers utilizing a 
network; 

(b) distributing a pre-release scanner update from the server to the computers simultaneously 
with the full-release update utilizing the network; 

(c) executing the full-release scanner update on the computers for security scanning; 

(d) determining whether the computers are idle; 

(e) automatically executing the pre-release scanner update on the computers for testing purposes 
upon the computers being determined to be idle; 

(f) comparing results of the execution of the full-release scanner update and the pre-release 
scanner update; 
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(g) determining whether a virus is detected by the execution of the pre-release scanner update 
and not by the full-release scanner update based on the comparison; 

(h) storing a record of the detected virus; 

(i) removing the detected virus; 

(j) detecting faults associated with the execution of the pre-release scanner update; 

(k) ceasing the execution of the pre-release scanner update on the computers in response to the 

detection of at least one fault; 

(1) re-executing the pre-release scanner update on the computers after ceasing the execution; 
(m) counting a number of the faults; 

(n) conditionally re-executing the pre-release scanner update on the computers if the number 
exceeds a predetermined number within a predetermined amount of time; 
(o) storing a record of the faults; 

(p) transmitting results relating to the viruses and faults from the computers to the server 
utilizing the network; and 

(q) modifying the pre-release scanner update at the server before releasing the pre-release 
scanner update as a full-release scanner update based on the results. 
Examiner's Response 

The limitations of this claim have been covered in the rejections above. 
Claim 33 

The method as recited in claim 32, wherein the recorded operations are performed by the pre- 
release scanner update during the execution of the pre release scanner update. 
Examiner's Response 
Norton, page 1 8, Scan History. 

Claim 34 

The method as recited in claim 32, wherein the operations are recorded in a queue. 
Examiner's Response 
Norton, page 18, Event Log. 

Claim 35 

The method as recited in claim 32, wherein results of the operations during the execution of the 
full-release scanner update and the pre-release scanner update are compared. 
Examiner's Response 

See 112 Rejection above - Too indefinite to determine scope of claim. 



Claim Rejections - 35 USC § 103 
5. The following is a quotation of 35 U.S.C 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 
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(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



6. Claims 22, 23, 24 and 25 are rejected by over Norton Antivirus Corporate Edition 
version 7.0. released 1999 (Called Norton) in view Norton Utility Antivirus for Netware version 
2, User's Guide published 1996 (Called Norton2). 

Norton teaches the download of virus scan software and the communicating between users and 
SARC but fails to explicitly teach the recording of the duration of execution time. It is Norton 2 
who teaches the recording of the duration of execution (Norton2, page provide Activity log 
options and transmission to server - top of page). Therefore it would have been obvious to one of 
ordinary skill in the art at the time of invention to combine Norton with Norton2 because 
capturing the status of error messages( Same page) and duration time to run software and 
transmit it for analysis, makes software more reliable. 
Claim 22 

The method as recited in claim 18, and further comprising counting a number of the faults, and 
conditionally terminating the pre-release scanner update on the computers based on the number. 
Examiner's Response 
Rejection above 

Claim 23 

The method as recited in claim 22, wherein the faults include at least one of delays, failures, 
crashes, and false alarms. 
Examiner's Response 
Rejection above 

Claim 24 

The method as recited in claim 1, and further comprising detecting a duration of the execution of 
the pre-release scanner update. 
Examiner's Response 
Rejection above 
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Claim 25 

The method as recited in claim 24, and further comprising transmitting a record of the duration 
from the computers to the server utilizing the network. 
Examiner's Response 
Rejection above 

Response to Arguments 

7. Applicants arguments file August 2, 2005 have been considered but are moot in view of 
the new ground(s) of rejection. 

Conclusion 

8. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Correspondence 

9. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Todd Ingberg whose telephone number is (571) 272-3723. The 
examiner can normally be reached on during the work week.. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kakali Chaki can be reached on (571) 272-3719. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-2 1 7-9 1 97 (toll-free). J 
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Primary Examiner 
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